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TOR  Log 


■  Logs  any  identified  TOR  routers  used  for 
anonymizing  Internet  traffic 

Searchable  fields 

■  TOR  from  server 

■  TOR  to  server 

■  Router  nickname 
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"Slowing  down  the  Internet" 


XKS  goal  is  to  store  the  full-take 
content  for  3-5  days,  effectively 
"slowing  down  the  Internet"  so  that 
analysts  can  go  back  and  recover 
sessions  that  otherwise  would  have 
been  dropped  by  the  front  end 

Meta-data  is  saved  off  longer,  with  the 
goal  of  30  days  retention 

A  lot  of  analysis  can  be  done  through 
meta-data  only  (MARINA  is  meta-data 
only) 
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What  makes  XKS  so  good  at  SIGDEV? 

XKS  gives  analysts  unique  access  to 
terabytes  of  content  and  meta-data 

Typically  sites  select  and  forward  to 
PINWALE  less  than  5%  of  the  DNI 
they're  processing 


The  rest  of  that  data  used  to  be  dropped 
but  is  now  being  retained  temporarily 
and  made  available  to  analysts  through 

X- KEYS  CO  RE 


As  an  example,  at  one  our  sites  XKS 
sees  more  data  per  day  than  all  of 

PINWALE 
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